Free tool
AI Policy and DPIA Builder
This free tool drafts an AI use policy for your business in minutes. You answer 10 questions. You get a policy with UK GDPR and ICO clauses, plus a short action checklist. There is also a path for a data protection impact assessment, or DPIA. You see the draft without giving an email.
- Free
- No email needed
How we work this out
The policy is built from your answers using a fixed template, so the same answers always give the same document. It covers purpose, scope, approved tools, data rules, human checks, openness, confidentiality and intellectual property, UK GDPR, incidents, training and review.
It points to the Information Commissioner's Office guidance on AI and data protection. If you sell into the EU it adds a short note on the EU AI Act, including the duty to make sure staff have enough AI literacy.
This is a starting template, not legal advice. Have someone who knows your business read it before you adopt it.
Example: ten answers produce a policy of about two pages with a table of what staff may and may not enter into AI tools, plus an action checklist.
How does the builder work?
- 1
Answer 10 questions about how your team uses AI, what data it touches and who approves its use
- 2
See a preview of your policy on screen
- 3
Download the full policy as a Word document, and a checklist of actions
For the DPIA path, the questions follow the structure the ICO sets out. The builder flags processing that looks high risk, and drafts the assessment for you to complete and review.
What are the assumptions behind the draft?
The builder works from fixed templates and your answers. The same answers give the same draft.
The policy covers what most small firms need. That means approved tools, what must never go into an AI tool, human checks, data protection and who is responsible. It includes UK GDPR and ICO clauses. If you sell to the EU, it adds a short note on the EU AI Act.
The DPIA flags are rules, not legal conclusions. A flag means "look at this closely". It does not mean the work is unlawful.
AI policy generator
What do I get to keep?
Your policy as a Word document
A short action checklist
A draft DPIA, if you chose that path
Common questions
Is this legal advice?
No. It is a draft to review and adapt. For anything high risk, ask a qualified adviser to check it.
Do I need a DPIA?
You need one when processing is likely to be high risk to people. The builder helps you spot that. The ICO has guidance on when one is required.
Does a small firm need an AI policy?
If staff use AI tools at work, a short policy helps. It tells them what is allowed and what is not.
Can I edit the policy?
Yes. It downloads as a Word document, so you can change anything.
What if I need more than a draft?
Our AI Governance and Compliance service covers policy, risk assessment and staff briefing.
Privacy
Please do not type personal data into your answers. We use your answers to draft your policy, and we save them without your name or email to see how the tool is used. If you ask for the files by email, we keep your email and results for up to 12 months and then delete them. Read our privacy policy.
What next?
If the DPIA flags something, or you want a policy checked by a person, talk to us. Bring your draft to a call.
Have a person check your draft
The first call is free. Bring your policy or DPIA draft, and we say what to tighten.